T09 · Insecure Skill Coding Practices
Error
- Location
scripts/job-code.mjs:5- Finding
Purge confirmation code does not bind the complete deletion scope
- Content
View full analysis
- Remediation
View remediation
Security audit
Discord Purge Bot
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly designed for Discord cleanup, but its destructive Discord deletion features have under-scoped confirmation checks that could allow broader deletion than the preview implied.
Review before installing. Use a least-privileged Discord bot token, prefer DISCORD_BOT_TOKEN over --token, test with dry runs, and do not rely on the provided confirmation codes as strong proof that the exact previewed deletion scope is what will run. Avoid nuke mode with --delete-old unless you are prepared for irreversible loss of the original channel.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/purge-nuke.mjs:57- Finding
Nuke confirmation does not distinguish cloning from deletion of the original channel
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/purge-runner.mjs:123- Finding
Message purge runner does not enforce the documented guild-channel restriction
- Content
View full analysis
{ result.scannedCount = progress.scannedCount; result.matchedCount = progress.matchedCount; await writeState(stateFile, result); }, }); ``` ### Technical Analysis The skill's safety contract states that destructive operations must abort if the target is not a guild channel. The nuke flow calls `getChannel` and verifies `channel.guild_id`, but the ordinary purge runn ...[truncated 1471 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/common.mjs:68- Finding
Bot token command-line option can expose credentials to local process inspection and shell history
- Content
View full analysis
Discord bot token (or use DISCORD_BOT_TOKEN) ``` ### Technical Analysis Passing a secret using `--token ` places the Discord bot token in the process argument vector. Depending on the operating system and process isolation settings, command-line arguments may be visible through process-monitoring tools, `/proc`, job supervisors, telemetry, crash reports, or audit systems. Interactive shell history may also persist the complete command. The token is subsequently sent only to the fixed Discord API endpoint as an `Authorization` header, which is necessary for the declared functionality. The identified problem is the optional command-line secret ingestion path, not the Discord API authentication itself. ### Attack Path 1. An operator follows the documented `--token` option and launches a preview, purge, or nuke command. 2. The plaintext token is stored in the process command line and potentially in shell history. 3. Another local user, monitoring agent, process supervisor, or log collector reads the command arguments or history. 4. The observer extracts the bot token. 5. The token is used directly against Discord's API until revoked. 6. The attacker obtains all capabilities granted to that bot role, potentially including message or channel management. ### Impa ...[truncated 505 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (18)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Run `purge-preview.mjs` first for every destructive request.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Run `purge-preview.mjs` first for every destructive request.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Run `purge-preview.mjs` first for every destructive request.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Run `purge-preview.mjs` first for every destructive request.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/purge-runner.mjs \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/purge-runner.mjs \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/purge-runner.mjs \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/purge-nuke.mjs --channel-id 123456789012345678 --confirm "NUKE-XXXXXXXX" --out ./tmp/nuke.json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/purge-nuke.mjs --channel-id 123456789012345678 --confirm "NUKE-XXXXXXXX" --out ./tmp/nuke.json
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/purge-nuke.mjs --channel-id 123456789012345678 --confirm "NUKE-XXXXXXXX" --out ./tmp/nuke.json
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ## Core Endpoints - List messages: `GET /channels/{channel.id}/messages` - Delete one message: `DELETE /channels/{channel.id}/messages/{message.id}` - Bulk delete: `POST /channels/{channel.id}/messages/bulk-delete` - Get channel: `GET /channels/{channel.id}` - Create guild channel: `POST /guilds/{guild.id}/channels`
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - Bulk delete: `POST /channels/{channel.id}/messages/bulk-delete` - Get channel: `GET /channels/{channel.id}` - Create guild channel: `POST /guilds/{guild.id}/channels` - Delete channel: `DELETE /channels/{channel.id}` ## Bulk Delete Rules
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The bulkDeleteMessages and deleteMessage helpers perform irreversible deletion of Discord messages, yet there is no confirmation prompt, user-facing notice, or inline documentation warning about the destructive effect. Code-file guidance calls for disclosure around destructive or irreversible operations when no other warning is present.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The deleteChannel function issues a DELETE request that can permanently remove a Discord channel, but the file contains no confirmation prompt, user-facing log, or explanatory comment/docstring disclosing that destructive action. This matches the missing-warning criterion for destructive or irreversible operations in code files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code performs authenticated HTTP requests to the Discord API using a token in the Authorization header and may send request bodies, but the file provides no confirmation prompt, user-facing log, or explanatory comment/docstring warning that external network transmission occurs. For a code file, network calls that transmit user or system data should have some visible disclosure unless clearly documented elsewhere.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
resolveToken reads DISCORD_BOT_TOKEN from the environment, which is access to sensitive credential material. This file does not include any user-facing notice, comment, or docstring explaining that the skill may obtain authentication data from environment variables.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The writeJson helper creates directories and writes JSON to an arbitrary resolved path, which is a safety-relevant file modification operation. In this file there is no confirmation prompt, user-facing log/print, or explanatory comment/docstring disclosing that behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This function calls
fetchMessagesPagewith a token and channel ID to retrieve message data from an external service, which is a network operation involving potentially sensitive user or system data. In this file there is no confirmation prompt, logging, comment, or docstring disclosing that message content will be fetched and scanned.- Content